Privacy notice template

How to use it

1. Replace every [BRACKETED] placeholder with your own details.
2. Give it to the person before you record their data — on paper, by email, or as the first page of your consent form.
3. Keep the marketing tick box separate from the notice itself. Bundling them makes the consent invalid.
4. Record the consent in Wolk and attach the signed copy, so the evidence and the notice version stay together.

The notice

Who is processing your data

[AGENCY NAME], [REGISTERED ADDRESS], VAT/company number [NUMBER], is the controller of your personal data. You can reach us at [EMAIL] or [PHONE]. [If you have appointed a DPO: Our Data Protection Officer can be contacted at [DPO EMAIL].]

What we collect

Your name, contact details, the source through which we met you, your property requirements and budget, notes from our conversations and viewings, and, where relevant, details of the property you are selling.

Why we process it, and on what legal basis

• To provide our brokerage service — finding, viewing and negotiating property on your behalf. Legal basis: performance of a contract, or steps taken at your request before entering one (Art. 6(1)(b)).
• To match your requirements against properties we hold, and to contact you about them. Legal basis: performance of a contract, or our legitimate interest in providing a useful service (Art. 6(1)(b) or (f)).
• To meet our legal obligations, including anti-money-laundering checks and keeping records of the transaction. Legal basis: legal obligation (Art. 6(1)(c)).
• To send you marketing about other properties and our services. Legal basis: your consent (Art. 6(1)(a)). This is optional and you can withdraw it at any time.

Who we share it with

Our agents and staff, who are authorised to process it under our instructions. Our CRM provider, Wolk (Marco Carotenuto, Italy), which acts as our processor and whose own subprocessors are listed at wolk.website/subprocessors. Where a transaction proceeds: notaries, lenders, surveyors and the counterparty’s agent, as necessary. Public authorities where the law requires it. [ADD OR REMOVE AS APPLICABLE.]

How long we keep it

For active enquiries, [PERIOD, e.g. 24 months] from our last contact with you. Where a transaction completes, [PERIOD, e.g. 10 years] to meet our accounting and anti-money-laundering obligations. Marketing consent records are kept for as long as the consent is relied on, and afterwards as evidence that it was validly given and lawfully withdrawn.

Transfers outside the EEA

Our CRM is hosted on infrastructure located in the United States. Those transfers are covered by the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguards in place.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format (Articles 15 to 22). Where we rely on your consent, you can withdraw it at any time, without affecting what we did lawfully beforehand. Write to [EMAIL] and we will respond within one month.

Complaints

If you believe we have handled your data improperly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the supervisory authority in your country of residence.

Is providing your data mandatory?

The contact and requirement details are necessary for us to act for you; without them we cannot provide the service. Marketing consent is entirely optional and refusing it changes nothing about the service you receive.

The consent statement

Keep this separate from the notice above, with its own signature, and never pre-tick it.

Scan or photograph the signed sheet into the contact’s consent register in Wolk. Each entry keeps the date, the method and the document, and a later withdrawal is added as a new entry rather than overwriting this one.